Hong Kong police have described a scam method in which victims are persuaded to install a malicious APK, switch on NFC and place a payment card against their phone, potentially enabling unauthorised card transactions.

The approach begins with a message or phone call posing as customer service. The fraudster may claim that a delivery, refund, insurance payment or membership needs attention, then guide the target to another messaging service, a fake website or a screen-sharing session. Police said the aim is to lead victims through steps on their phone and in online banking.

In the NFC version, the victim receives the APK through an instant-messaging service and installs it before granting permissions. The fraudster then persuades the victim to enable NFC and tap the card on the phone. Police said the victim may later see unusual e-banking transactions and receive a bank notification that the card has been misused.

The Cyber Security and Technology Crime Bureau said police recorded 29,670 fraud cases in Hong Kong from January to August 2026, involving HK$5.21 billion in losses. More than 5,000 were fake-customer-service scams, with losses of about HK$700 million. Rachel Hui Yee-wai, a bureau superintendent, said the category accounted for about 17% of all fraud cases and 13.3% of reported losses.

Message-based cases averaged 40 a month between January and July but exceeded 80 in August, while the associated monthly losses rose from an average of HK$6.2 million to HK$12 million.

One police case involved a 53-year-old housewife who received a call from someone posing as Taobao customer service. After being told a damaged parcel qualified for compensation, she was directed to a fake online-banking website and told to enter a supposed verification code in the transfer-amount field. Police said she ultimately transferred HK$4.46 million; the supposed code was the payment amount.

Police advised residents to download apps only through official channels, reject unexpected screen-sharing requests and never follow a stranger’s instructions to read a card or enable NFC. Before confirming a transfer, they should check the payee and amount and never enter a purported verification code in the transfer-amount field. Suspicious phone numbers, links and screenshots can be checked with the police anti-scam risk-checking tool, or through the 18222 anti-scam hotline.